HaiLa for restaurants
Providers and sub-processors
This is the list of the providers that HaiLa uses to provide the service and that receive personal data of restaurants’ guests or staff. HaiLa keeps the list current, as provided for in the Data Processing Agreement (DPA).
Version 1.1, in force from October 1, 2026
1. Providers and data received
| Provider | Service | What data it receives | Where |
|---|---|---|---|
| Firebase App Hosting (Cloud Run): hosting of the haila.md and restaurants.haila.md websites. | Every page request: the IP address, the browser type (user agent), the session cookie. | Europe, region europe-west4 | |
| Cloud Firestore and Cloud Storage: the database and the files. | Accounts, bookings, reviews, guest records, photos, records of visits to the site. | provided on request | |
| Cloud Functions: booking logic, emails, push notifications, scheduled tasks. | All the data the server processes. | United States, region us-central1, by default; the booking functions and those for restaurant staff also run in Europe, in the regions europe-west4 and europe-west1 | |
| Firebase Authentication (Identity Platform): authentication, including sending the code by SMS for authentication with a phone number. | The phone number, the Google or Apple identity, the IP address, the reCAPTCHA assessment. | provided on request | |
| reCAPTCHA (Enterprise, with version v2 as a fallback): the check against bots at authentication with a phone number. | The IP address and browser signals. | provided on request | |
| Google Ireland Limited | Google Analytics 4: audience measurement, only after the visitor’s consent. | Pages visited, events (the restaurant’s identifier, the language), the _ga identifier, the IP address. | provided on request |
| Google Maps Platform, Routes API: the travel time to the venue, for the function that tells the guest when to leave, and for distances when the guest has chosen a point. | The exact coordinates of the guest and those of the venue. | provided on request | |
| Google, together with Apple’s push notification service for iOS devices | Firebase Cloud Messaging: push notifications in the apps and, on request, in the browser. | The device’s notification identifier (token) and the text of the notification. | provided on request |
| Vertex AI (Gemini): artificial intelligence functions, namely Ask HaiLa, the planner, the suggested replies to guests and to reviews, the rewriting and translation of campaigns, the reading of menus and the translation of reviews on request. | Lists of bookings with guests’ names, masked phone numbers, email addresses of the accounts found by search, the text of reviews, guests’ messages, menu files. | The service’s “global” location | |
| The Firebase extension for resizing images. | The photos uploaded. | Europe, region europe-west3 | |
| Google Fonts: the fonts of a venue’s QR menu page. The rest of the site hosts its own fonts. | The visitor’s IP address, through a direct request from the browser. | provided on request | |
| Resend | Email: transactional messages, venues’ letters to their guests (newsletters, campaigns, automations) and the summary for owners. | The email address and name of guests and of staff, the booking details in the message, the content of the letters, the replies received, the delivery events. | provided on request |
| Sentry | Monitoring of errors on the site. | Errors in the browser and on the server, with the page address, browser type and IP address; on an error, a session replay with all text masked and with images and video blocked; a 2% sample of performance measurements. No user identifier is attached. | provided on request |
| OpenFreeMap | The maps on the search, city and venue pages. | The visitor’s IP address and the map area viewed, through a direct request from the browser. | provided on request |
| Twilio | SMS with the authentication code for older versions of the apps. A legacy provider: the site no longer uses it, and authentication codes are now sent through Firebase Authentication (Google). | The phone number. | provided on request |
The “Where” column indicates the region only where it is set in the platform’s configuration. For the other services, the processing location is provided on request, at dpo@haila.md.
The POS systems that the Restaurant connects to HaiLa (Poster, Syrve or iiko, Ebriza) are the Restaurant’s own systems and providers. When a booking is confirmed, HaiLa sends the connected system, depending on the integration, the guest’s name, the phone number, the number of people and the time, and receives from the system tables, orders and bills. These providers are recipients chosen by the Restaurant, not sub-processors of HaiLa.
Apple and Google, when a person chooses authentication with an Apple or Google account, act as independent controllers, not as processors. HaiLa receives the name and the email address from them.
2. Changes to the list
The Restaurant authorises HaiLa to use sub-processors to provide the service, under the conditions of section 14 of the DPA. HaiLa imposes on them data protection obligations substantially equivalent to the relevant obligations in the DPA and remains liable to the Restaurant for the performance of the obligations they undertake, to the extent provided by law and by the contract.
For a new sub-processor that involves Restaurant Data, as defined in the DPA, HaiLa gives reasonable prior notice, through the contractual mechanism or through the established channel, and updates this list.
The Restaurant may raise a reasoned objection, on serious data protection grounds. The parties will try to identify a reasonable solution. Objections and questions about the list are sent to dpo@haila.md.